Configuring Fortigate for VOIP phones behind it

These are the general steps for allowing VOIP phones behind a Fortigate to work properly.  Please also note these steps to put QoS on voice traffic for better performance.

1. Open the Fortigate CLI from the dashboard.
2. Enter the following commands in FortiGate’s CLI:
   1. config system settings
   2. set sip-helper disable
   3. set sip-nat-trace disable
   4. reboot the device
3. Reopen CLI and enter the following commands – do not enter the text after //:
   1. config system session-helper
   2. show    //locate the SIP entry, usually 12, but can vary.
   3. delete 12     //or the number that you identified from the previous command.
4. Disable RTP processing as follows:
   1. config voip profile
   2. edit default
   3. config sip
   4. set rtp disable

There might be other settings that you need to configure depending on the FortiOS version that you are using. If you continue encountering issues related to SIP ALG, please contact Fortinet Support.

Configuring VOIP priority on a Fortigate firewall

IMPORTANT NOTE - If you are sending your voice traffic over a route based IPSec VPN, the WAN interface you'll be referencing will the the name of the VPN interface (for example DCtoSF instead of WAN1).


I put together this list of CLI commands to enter on a Fortigate firewall to give VOIP traffic priority.  Some instructions may vary based on your setup, but I took most of these from Fortigate cookbooks and then fixed all the typos.  I use the CLI commands because the GUI (my preference) didn't have all the options where they were supposed to be in my test box.  I tested this on Fortigate 40C running version 5.0 of the firmware.

config firewall shaper traffic-shaper
edit voip
set maximum-bandwidth 1000
set guaranteed-bandwidth 800
set per-policy enable
set priority high
end


then

config firewall policy
edit 6
set srcintf internal
set srcaddr all
set dstintf wan1
set dstaddr all
set action accept
set schedule always
set service SIP
set traffic-shaper voip
set traffic-shaper-reverse voip
end


Please also note these steps for disabling SIP ALG and other processes to allow VOIP phones behind a Fortigate firewall.